CVE-2026-27078: 
WordPress vulnerability analysis and mitigation

CVE-2026-27078 is a PHP Local File Inclusion (LFI) vulnerability in the Mikado-Themes Emaurri WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects Emaurri versions up to and including 1.0.1, and was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 10, 2025, with public disclosure on March 10, 2026 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The root cause is improper control of filename parameters used in PHP include/require statements within the Emaurri theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server's filesystem. The attack vector is network-based, requires no authentication or user interaction, but has high attack complexity, suggesting some precondition or non-trivial exploitation step is involved. An unauthenticated remote attacker can craft a malicious HTTP request that passes a controlled filename to a vulnerable PHP include statement, causing the server to read and potentially execute arbitrary local files (Patchstack).

Successful exploitation allows an attacker to read sensitive local files — such as WordPress configuration files (wp-config.php) containing database credentials — potentially enabling full database takeover. If combined with a file upload vulnerability or other technique to place attacker-controlled PHP content on the server, LFI can escalate to remote code execution, resulting in high impact on confidentiality, integrity, and availability of the affected system (Patchstack, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Emaurri theme (version ≤ 1.0.1) via passive scanning tools (e.g., WPScan, Shodan) or by checking theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that accepts user-controlled input without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, which may expose database credentials, API keys, or system information.
5. Escalate if possible: If a writable directory exists and file upload is possible (e.g., via media upload), upload a PHP web shell and use the LFI to include and execute it, achieving remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files (wp-config.php, /etc/passwd).
• Logs: Web server access logs showing requests with encoded or plaintext directory traversal patterns targeting Emaurri theme files; repeated 200 OK responses to such requests may indicate successful exploitation.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual PHP child processes spawned by the web server (e.g., curl, wget, bash) that may indicate code execution following LFI escalation.

The vendor has released a patched version: Emaurri 1.5. All users running version 1.0.1 or earlier should update to version 1.5 immediately. As interim mitigations, administrators should implement a web application firewall (WAF) rule to block path traversal patterns in request parameters; Patchstack has issued a virtual patch/mitigation rule for subscribers. Additionally, restrict PHP file inclusion to trusted paths using open_basedir in php.ini, and audit web server logs for signs of exploitation attempts (Patchstack).

The vulnerability was reported through Patchstack's coordinated disclosure process by researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and was also noted in Wordfence's weekly WordPress vulnerability report for the week of March 9–15, 2026. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries (Wordfence Blog, Patchstack).